source3/modules/vfs_time_audit.c

   1 /*
   2  * Time auditing VFS module for samba.  Log time taken for VFS call to syslog
   3  * facility.
   4  *
   5  * Copyright (C) Abhidnya Chirmule <achirmul@in.ibm.com> 2009
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 /*
  22  * This module implements logging for time taken for all Samba VFS operations.
  23  *
  24  * vfs objects = time_audit
  25  */
  26
  27
  28 #include "includes.h"
  29 #include "smbd/smbd.h"
  30 #include "ntioctl.h"
  31 #include "lib/util/tevent_unix.h"
  32 #include "lib/util/tevent_ntstatus.h"
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_VFS
  36
  37 static double audit_timeout;
  38
  39 static void smb_time_audit_log_msg(const char *syscallname, double elapsed,
  40                                     const char *msg)
  41 {
  42         DEBUG(0, ("WARNING: VFS call \"%s\" took unexpectedly long "
  43                   "(%.2f seconds) %s%s-- Validate that file and storage "
  44                   "subsystems are operating normally\n", syscallname,
  45                   elapsed, (msg != NULL) ? msg : "",
  46                   (msg != NULL) ? " " : ""));
  47 }
  48
  49 static void smb_time_audit_log(const char *syscallname, double elapsed)
  50 {
  51         smb_time_audit_log_msg(syscallname, elapsed, NULL);
  52 }
  53
  54 static void smb_time_audit_log_fsp(const char *syscallname, double elapsed,
  55                                    const struct files_struct *fsp)
  56 {
  57         char *base_name = NULL;
  58         char *connectpath = NULL;
  59         char *msg = NULL;
  60
  61         if (fsp == NULL) {
  62                 smb_time_audit_log(syscallname, elapsed);
  63                 return;
  64         }
  65         if (fsp->conn)
  66                 connectpath = fsp->conn->connectpath;
  67         if (fsp->fsp_name)
  68                 base_name = fsp->fsp_name->base_name;
  69
  70         if (connectpath != NULL && base_name != NULL) {
  71                 msg = talloc_asprintf(talloc_tos(), "filename = \"%s/%s\"",
  72                                       connectpath, base_name);
  73         } else if (connectpath != NULL && base_name == NULL) {
  74                 msg = talloc_asprintf(talloc_tos(), "connectpath = \"%s\", "
  75                                       "base_name = <NULL>",
  76                                       connectpath);
  77         } else if (connectpath == NULL && base_name != NULL) {
  78                 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
  79                                       "base_name = \"%s\"",
  80                                       base_name);
  81         } else { /* connectpath == NULL && base_name == NULL */
  82                 msg = talloc_asprintf(talloc_tos(), "connectpath = <NULL>, "
  83                                       "base_name = <NULL>");
  84         }
  85         smb_time_audit_log_msg(syscallname, elapsed, msg);
  86         TALLOC_FREE(msg);
  87 }
  88
  89 static void smb_time_audit_log_fname(const char *syscallname, double elapsed,
  90                                     const char *fname)
  91 {
  92         char cwd[PATH_MAX];
  93         char *msg = NULL;
  94
  95         if (getcwd(cwd, sizeof(cwd)) == NULL) {
  96                 snprintf(cwd, sizeof(cwd), "<getcwd() error %d>", errno);
  97         }
  98         if (fname != NULL) {
  99                 msg = talloc_asprintf(talloc_tos(),
 100                                       "cwd = \"%s\", filename = \"%s\"",
 101                                       cwd, fname);
 102         } else {
 103                 msg = talloc_asprintf(talloc_tos(),
 104                                       "cwd = \"%s\", filename = <NULL>",
 105                                       cwd);
 106         }
 107         smb_time_audit_log_msg(syscallname, elapsed, msg);
 108         TALLOC_FREE(msg);
 109 }
 110
 111 static void smb_time_audit_log_smb_fname(const char *syscallname, double elapsed,
 112                                        const struct smb_filename *smb_fname)
 113 {
 114         if (smb_fname != NULL) {
 115                 smb_time_audit_log_fname(syscallname, elapsed,
 116                                          smb_fname->base_name);
 117         } else {
 118                 smb_time_audit_log_fname(syscallname, elapsed,
 119                                          "smb_fname = <NULL>");
 120         }
 121 }
 122
 123 static int smb_time_audit_connect(vfs_handle_struct *handle,
 124                                   const char *svc, const char *user)
 125 {
 126         int result;
 127         struct timespec ts1,ts2;
 128         double timediff;
 129
 130         if (!handle) {
 131                 return -1;
 132         }
 133
 134         clock_gettime_mono(&ts1);
 135         result = SMB_VFS_NEXT_CONNECT(handle, svc, user);
 136         clock_gettime_mono(&ts2);
 137         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 138         if (timediff > audit_timeout) {
 139                 smb_time_audit_log_msg("connect", timediff, user);
 140         }
 141         return result;
 142 }
 143
 144 static void smb_time_audit_disconnect(vfs_handle_struct *handle)
 145 {
 146         struct timespec ts1,ts2;
 147         double timediff;
 148
 149         clock_gettime_mono(&ts1);
 150         SMB_VFS_NEXT_DISCONNECT(handle);
 151         clock_gettime_mono(&ts2);
 152         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 153
 154         if (timediff > audit_timeout) {
 155                 smb_time_audit_log("disconnect", timediff);
 156         }
 157 }
 158
 159 static uint64_t smb_time_audit_disk_free(vfs_handle_struct *handle,
 160                                          const char *path, uint64_t *bsize,
 161                                          uint64_t *dfree, uint64_t *dsize)
 162 {
 163         uint64_t result;
 164         struct timespec ts1,ts2;
 165         double timediff;
 166
 167         clock_gettime_mono(&ts1);
 168         result = SMB_VFS_NEXT_DISK_FREE(handle, path, bsize, dfree, dsize);
 169         clock_gettime_mono(&ts2);
 170         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 171
 172         /* Don't have a reasonable notion of failure here */
 173         if (timediff > audit_timeout) {
 174                 smb_time_audit_log_fname("disk_free", timediff, path);
 175         }
 176
 177         return result;
 178 }
 179
 180 static int smb_time_audit_get_quota(struct vfs_handle_struct *handle,
 181                                     enum SMB_QUOTA_TYPE qtype, unid_t id,
 182                                     SMB_DISK_QUOTA *qt)
 183 {
 184         int result;
 185         struct timespec ts1,ts2;
 186         double timediff;
 187
 188         clock_gettime_mono(&ts1);
 189         result = SMB_VFS_NEXT_GET_QUOTA(handle, qtype, id, qt);
 190         clock_gettime_mono(&ts2);
 191         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 192
 193         if (timediff > audit_timeout) {
 194                 smb_time_audit_log("get_quota", timediff);
 195         }
 196         return result;
 197 }
 198
 199 static int smb_time_audit_set_quota(struct vfs_handle_struct *handle,
 200                                     enum SMB_QUOTA_TYPE qtype, unid_t id,
 201                                     SMB_DISK_QUOTA *qt)
 202 {
 203         int result;
 204         struct timespec ts1,ts2;
 205         double timediff;
 206
 207         clock_gettime_mono(&ts1);
 208         result = SMB_VFS_NEXT_SET_QUOTA(handle, qtype, id, qt);
 209         clock_gettime_mono(&ts2);
 210         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 211
 212         if (timediff > audit_timeout) {
 213                 smb_time_audit_log("set_quota", timediff);
 214         }
 215
 216         return result;
 217 }
 218
 219 static int smb_time_audit_get_shadow_copy_data(struct vfs_handle_struct *handle,
 220                                                struct files_struct *fsp,
 221                                                struct shadow_copy_data *shadow_copy_data,
 222                                                bool labels)
 223 {
 224         int result;
 225         struct timespec ts1,ts2;
 226         double timediff;
 227
 228         clock_gettime_mono(&ts1);
 229         result = SMB_VFS_NEXT_GET_SHADOW_COPY_DATA(handle, fsp,
 230                                                    shadow_copy_data, labels);
 231         clock_gettime_mono(&ts2);
 232         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 233
 234         if (timediff > audit_timeout) {
 235                 smb_time_audit_log_fsp("get_shadow_copy_data", timediff, fsp);
 236         }
 237
 238         return result;
 239 }
 240
 241 static int smb_time_audit_statvfs(struct vfs_handle_struct *handle,
 242                                   const char *path,
 243                                   struct vfs_statvfs_struct *statbuf)
 244 {
 245         int result;
 246         struct timespec ts1,ts2;
 247         double timediff;
 248
 249         clock_gettime_mono(&ts1);
 250         result = SMB_VFS_NEXT_STATVFS(handle, path, statbuf);
 251         clock_gettime_mono(&ts2);
 252         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 253
 254         if (timediff > audit_timeout) {
 255                 smb_time_audit_log_fname("statvfs", timediff, path);
 256         }
 257
 258         return result;
 259 }
 260
 261 static uint32_t smb_time_audit_fs_capabilities(struct vfs_handle_struct *handle,
 262                                                enum timestamp_set_resolution *p_ts_res)
 263 {
 264         uint32_t result;
 265         struct timespec ts1,ts2;
 266         double timediff;
 267
 268         clock_gettime_mono(&ts1);
 269         result = SMB_VFS_NEXT_FS_CAPABILITIES(handle, p_ts_res);
 270         clock_gettime_mono(&ts2);
 271         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 272
 273         if (timediff > audit_timeout) {
 274                 smb_time_audit_log("fs_capabilities", timediff);
 275         }
 276
 277         return result;
 278 }
 279
 280 static NTSTATUS smb_time_audit_snap_check_path(struct vfs_handle_struct *handle,
 281                                                TALLOC_CTX *mem_ctx,
 282                                                const char *service_path,
 283                                                char **base_volume)
 284 {
 285         NTSTATUS status;
 286         struct timespec ts1,ts2;
 287         double timediff;
 288
 289         clock_gettime_mono(&ts1);
 290         status = SMB_VFS_NEXT_SNAP_CHECK_PATH(handle, mem_ctx, service_path,
 291                                               base_volume);
 292         clock_gettime_mono(&ts2);
 293         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
 294
 295         if (timediff > audit_timeout) {
 296                 smb_time_audit_log("snap_check_path", timediff);
 297         }
 298
 299         return status;
 300 }
 301
 302 static NTSTATUS smb_time_audit_snap_create(struct vfs_handle_struct *handle,
 303                                            TALLOC_CTX *mem_ctx,
 304                                            const char *base_volume,
 305                                            time_t *tstamp,
 306                                            bool rw,
 307                                            char **base_path,
 308                                            char **snap_path)
 309 {
 310         NTSTATUS status;
 311         struct timespec ts1,ts2;
 312         double timediff;
 313
 314         clock_gettime_mono(&ts1);
 315         status = SMB_VFS_NEXT_SNAP_CREATE(handle, mem_ctx, base_volume, tstamp,
 316                                           rw, base_path, snap_path);
 317         clock_gettime_mono(&ts2);
 318         timediff = nsec_time_diff(&ts2 ,&ts1) * 1.0e-9;
 319
 320         if (timediff > audit_timeout) {
 321                 smb_time_audit_log("snap_create", timediff);
 322         }
 323
 324         return status;
 325 }
 326
 327 static NTSTATUS smb_time_audit_snap_delete(struct vfs_handle_struct *handle,
 328                                            TALLOC_CTX *mem_ctx,
 329                                            char *base_path,
 330                                            char *snap_path)
 331 {
 332         NTSTATUS status;
 333         struct timespec ts1,ts2;
 334         double timediff;
 335
 336         clock_gettime_mono(&ts1);
 337         status = SMB_VFS_NEXT_SNAP_DELETE(handle, mem_ctx, base_path,
 338                                           snap_path);
 339         clock_gettime_mono(&ts2);
 340         timediff = nsec_time_diff(&ts2, &ts1) * 1.0e-9;
 341
 342         if (timediff > audit_timeout) {
 343                 smb_time_audit_log("snap_delete", timediff);
 344         }
 345
 346         return status;
 347 }
 348
 349 static DIR *smb_time_audit_opendir(vfs_handle_struct *handle,
 350                                    const char *fname,
 351                                    const char *mask, uint32 attr)
 352 {
 353         DIR *result;
 354         struct timespec ts1,ts2;
 355         double timediff;
 356
 357         clock_gettime_mono(&ts1);
 358         result = SMB_VFS_NEXT_OPENDIR(handle, fname, mask, attr);
 359         clock_gettime_mono(&ts2);
 360         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 361
 362         if (timediff > audit_timeout) {
 363                 smb_time_audit_log_fname("opendir", timediff, fname);
 364         }
 365
 366         return result;
 367 }
 368
 369 static DIR *smb_time_audit_fdopendir(vfs_handle_struct *handle,
 370                                               files_struct *fsp,
 371                                               const char *mask, uint32 attr)
 372 {
 373         DIR *result;
 374         struct timespec ts1,ts2;
 375         double timediff;
 376
 377         clock_gettime_mono(&ts1);
 378         result = SMB_VFS_NEXT_FDOPENDIR(handle, fsp, mask, attr);
 379         clock_gettime_mono(&ts2);
 380         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 381
 382         if (timediff > audit_timeout) {
 383                 smb_time_audit_log_fsp("fdopendir", timediff, fsp);
 384         }
 385
 386         return result;
 387 }
 388
 389 static struct dirent *smb_time_audit_readdir(vfs_handle_struct *handle,
 390                                                  DIR *dirp,
 391                                                  SMB_STRUCT_STAT *sbuf)
 392 {
 393         struct dirent *result;
 394         struct timespec ts1,ts2;
 395         double timediff;
 396
 397         clock_gettime_mono(&ts1);
 398         result = SMB_VFS_NEXT_READDIR(handle, dirp, sbuf);
 399         clock_gettime_mono(&ts2);
 400         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 401
 402         if (timediff > audit_timeout) {
 403                 smb_time_audit_log("readdir", timediff);
 404         }
 405
 406         return result;
 407 }
 408
 409 static void smb_time_audit_seekdir(vfs_handle_struct *handle,
 410                                    DIR *dirp, long offset)
 411 {
 412         struct timespec ts1,ts2;
 413         double timediff;
 414
 415         clock_gettime_mono(&ts1);
 416         SMB_VFS_NEXT_SEEKDIR(handle, dirp, offset);
 417         clock_gettime_mono(&ts2);
 418         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 419
 420         if (timediff > audit_timeout) {
 421                 smb_time_audit_log("seekdir", timediff);
 422         }
 423
 424 }
 425
 426 static long smb_time_audit_telldir(vfs_handle_struct *handle,
 427                                    DIR *dirp)
 428 {
 429         long result;
 430         struct timespec ts1,ts2;
 431         double timediff;
 432
 433         clock_gettime_mono(&ts1);
 434         result = SMB_VFS_NEXT_TELLDIR(handle, dirp);
 435         clock_gettime_mono(&ts2);
 436         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 437
 438         if (timediff > audit_timeout) {
 439                 smb_time_audit_log("telldir", timediff);
 440         }
 441
 442         return result;
 443 }
 444
 445 static void smb_time_audit_rewinddir(vfs_handle_struct *handle,
 446                                      DIR *dirp)
 447 {
 448         struct timespec ts1,ts2;
 449         double timediff;
 450
 451         clock_gettime_mono(&ts1);
 452         SMB_VFS_NEXT_REWINDDIR(handle, dirp);
 453         clock_gettime_mono(&ts2);
 454         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 455
 456         if (timediff > audit_timeout) {
 457                 smb_time_audit_log("rewinddir", timediff);
 458         }
 459
 460 }
 461
 462 static int smb_time_audit_mkdir(vfs_handle_struct *handle,
 463                                 const char *path, mode_t mode)
 464 {
 465         int result;
 466         struct timespec ts1,ts2;
 467         double timediff;
 468
 469         clock_gettime_mono(&ts1);
 470         result = SMB_VFS_NEXT_MKDIR(handle, path, mode);
 471         clock_gettime_mono(&ts2);
 472         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 473
 474         if (timediff > audit_timeout) {
 475                 smb_time_audit_log_fname("mkdir", timediff, path);
 476         }
 477
 478         return result;
 479 }
 480
 481 static int smb_time_audit_rmdir(vfs_handle_struct *handle,
 482                                 const char *path)
 483 {
 484         int result;
 485         struct timespec ts1,ts2;
 486         double timediff;
 487
 488         clock_gettime_mono(&ts1);
 489         result = SMB_VFS_NEXT_RMDIR(handle, path);
 490         clock_gettime_mono(&ts2);
 491         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 492
 493         if (timediff > audit_timeout) {
 494                 smb_time_audit_log_fname("rmdir", timediff, path);
 495         }
 496
 497         return result;
 498 }
 499
 500 static int smb_time_audit_closedir(vfs_handle_struct *handle,
 501                                    DIR *dirp)
 502 {
 503         int result;
 504         struct timespec ts1,ts2;
 505         double timediff;
 506
 507         clock_gettime_mono(&ts1);
 508         result = SMB_VFS_NEXT_CLOSEDIR(handle, dirp);
 509         clock_gettime_mono(&ts2);
 510         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 511
 512         if (timediff > audit_timeout) {
 513                 smb_time_audit_log("closedir", timediff);
 514         }
 515
 516         return result;
 517 }
 518
 519 static void smb_time_audit_init_search_op(vfs_handle_struct *handle,
 520                                           DIR *dirp)
 521 {
 522         struct timespec ts1,ts2;
 523         double timediff;
 524
 525         clock_gettime_mono(&ts1);
 526         SMB_VFS_NEXT_INIT_SEARCH_OP(handle, dirp);
 527         clock_gettime_mono(&ts2);
 528         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 529
 530         if (timediff > audit_timeout) {
 531                 smb_time_audit_log("init_search_op", timediff);
 532         }
 533 }
 534
 535 static int smb_time_audit_open(vfs_handle_struct *handle,
 536                                struct smb_filename *fname,
 537                                files_struct *fsp,
 538                                int flags, mode_t mode)
 539 {
 540         int result;
 541         struct timespec ts1,ts2;
 542         double timediff;
 543
 544         clock_gettime_mono(&ts1);
 545         result = SMB_VFS_NEXT_OPEN(handle, fname, fsp, flags, mode);
 546         clock_gettime_mono(&ts2);
 547         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 548
 549         if (timediff > audit_timeout) {
 550                 smb_time_audit_log_fsp("open", timediff, fsp);
 551         }
 552
 553         return result;
 554 }
 555
 556 static NTSTATUS smb_time_audit_create_file(vfs_handle_struct *handle,
 557                                            struct smb_request *req,
 558                                            uint16_t root_dir_fid,
 559                                            struct smb_filename *fname,
 560                                            uint32_t access_mask,
 561                                            uint32_t share_access,
 562                                            uint32_t create_disposition,
 563                                            uint32_t create_options,
 564                                            uint32_t file_attributes,
 565                                            uint32_t oplock_request,
 566                                            struct smb2_lease *lease,
 567                                            uint64_t allocation_size,
 568                                            uint32_t private_flags,
 569                                            struct security_descriptor *sd,
 570                                            struct ea_list *ea_list,
 571                                            files_struct **result_fsp,
 572                                            int *pinfo,
 573                                            const struct smb2_create_blobs *in_context_blobs,
 574                                            struct smb2_create_blobs *out_context_blobs)
 575 {
 576         NTSTATUS result;
 577         struct timespec ts1,ts2;
 578         double timediff;
 579
 580         clock_gettime_mono(&ts1);
 581         result = SMB_VFS_NEXT_CREATE_FILE(
 582                 handle,                                 /* handle */
 583                 req,                                    /* req */
 584                 root_dir_fid,                           /* root_dir_fid */
 585                 fname,                                  /* fname */
 586                 access_mask,                            /* access_mask */
 587                 share_access,                           /* share_access */
 588                 create_disposition,                     /* create_disposition*/
 589                 create_options,                         /* create_options */
 590                 file_attributes,                        /* file_attributes */
 591                 oplock_request,                         /* oplock_request */
 592                 lease,                                  /* lease */
 593                 allocation_size,                        /* allocation_size */
 594                 private_flags,
 595                 sd,                                     /* sd */
 596                 ea_list,                                /* ea_list */
 597                 result_fsp,                             /* result */
 598                 pinfo,
 599                 in_context_blobs, out_context_blobs);   /* create context */
 600         clock_gettime_mono(&ts2);
 601         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 602
 603         if (timediff > audit_timeout) {
 604                 /*
 605                  * can't use result_fsp this time, may have
 606                  * invalid content causing smbd crash
 607                  */
 608                 smb_time_audit_log_smb_fname("create_file", timediff,
 609                                            fname);
 610         }
 611
 612         return result;
 613 }
 614
 615 static int smb_time_audit_close(vfs_handle_struct *handle, files_struct *fsp)
 616 {
 617         int result;
 618         struct timespec ts1,ts2;
 619         double timediff;
 620
 621         clock_gettime_mono(&ts1);
 622         result = SMB_VFS_NEXT_CLOSE(handle, fsp);
 623         clock_gettime_mono(&ts2);
 624         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 625
 626         if (timediff > audit_timeout) {
 627                 smb_time_audit_log_fsp("close", timediff, fsp);
 628         }
 629
 630         return result;
 631 }
 632
 633 static ssize_t smb_time_audit_read(vfs_handle_struct *handle,
 634                                    files_struct *fsp, void *data, size_t n)
 635 {
 636         ssize_t result;
 637         struct timespec ts1,ts2;
 638         double timediff;
 639
 640         clock_gettime_mono(&ts1);
 641         result = SMB_VFS_NEXT_READ(handle, fsp, data, n);
 642         clock_gettime_mono(&ts2);
 643         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 644
 645         if (timediff > audit_timeout) {
 646                 smb_time_audit_log_fsp("read", timediff, fsp);
 647         }
 648
 649         return result;
 650 }
 651
 652 static ssize_t smb_time_audit_pread(vfs_handle_struct *handle,
 653                                     files_struct *fsp,
 654                                     void *data, size_t n, off_t offset)
 655 {
 656         ssize_t result;
 657         struct timespec ts1,ts2;
 658         double timediff;
 659
 660         clock_gettime_mono(&ts1);
 661         result = SMB_VFS_NEXT_PREAD(handle, fsp, data, n, offset);
 662         clock_gettime_mono(&ts2);
 663         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 664
 665         if (timediff > audit_timeout) {
 666                 smb_time_audit_log_fsp("pread", timediff, fsp);
 667         }
 668
 669         return result;
 670 }
 671
 672 struct smb_time_audit_pread_state {
 673         struct files_struct *fsp;
 674         struct timespec ts1;
 675         ssize_t ret;
 676         int err;
 677 };
 678
 679 static void smb_time_audit_pread_done(struct tevent_req *subreq);
 680
 681 static struct tevent_req *smb_time_audit_pread_send(
 682         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 683         struct tevent_context *ev, struct files_struct *fsp,
 684         void *data, size_t n, off_t offset)
 685 {
 686         struct tevent_req *req, *subreq;
 687         struct smb_time_audit_pread_state *state;
 688
 689         req = tevent_req_create(mem_ctx, &state,
 690                                 struct smb_time_audit_pread_state);
 691         if (req == NULL) {
 692                 return NULL;
 693         }
 694         clock_gettime_mono(&state->ts1);
 695         state->fsp = fsp;
 696
 697         subreq = SMB_VFS_NEXT_PREAD_SEND(state, ev, handle, fsp, data,
 698                                          n, offset);
 699         if (tevent_req_nomem(subreq, req)) {
 700                 return tevent_req_post(req, ev);
 701         }
 702         tevent_req_set_callback(subreq, smb_time_audit_pread_done, req);
 703         return req;
 704 }
 705
 706 static void smb_time_audit_pread_done(struct tevent_req *subreq)
 707 {
 708         struct tevent_req *req = tevent_req_callback_data(
 709                 subreq, struct tevent_req);
 710         struct smb_time_audit_pread_state *state = tevent_req_data(
 711                 req, struct smb_time_audit_pread_state);
 712
 713         state->ret = SMB_VFS_PREAD_RECV(subreq, &state->err);
 714         TALLOC_FREE(subreq);
 715         tevent_req_done(req);
 716 }
 717
 718 static ssize_t smb_time_audit_pread_recv(struct tevent_req *req, int *err)
 719 {
 720         struct smb_time_audit_pread_state *state = tevent_req_data(
 721                 req, struct smb_time_audit_pread_state);
 722         struct timespec ts2;
 723         double timediff;
 724
 725         clock_gettime_mono(&ts2);
 726         timediff = nsec_time_diff(&ts2,&state->ts1)*1.0e-9;
 727
 728         if (timediff > audit_timeout) {
 729                 smb_time_audit_log_fsp("pread", timediff, state->fsp);
 730         }
 731
 732         if (tevent_req_is_unix_error(req, err)) {
 733                 return -1;
 734         }
 735         *err = state->err;
 736         return state->ret;
 737 }
 738
 739 static ssize_t smb_time_audit_write(vfs_handle_struct *handle,
 740                                     files_struct *fsp,
 741                                     const void *data, size_t n)
 742 {
 743         ssize_t result;
 744         struct timespec ts1,ts2;
 745         double timediff;
 746
 747         clock_gettime_mono(&ts1);
 748         result = SMB_VFS_NEXT_WRITE(handle, fsp, data, n);
 749         clock_gettime_mono(&ts2);
 750         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 751
 752         if (timediff > audit_timeout) {
 753                 smb_time_audit_log_fsp("write", timediff, fsp);
 754         }
 755
 756         return result;
 757 }
 758
 759 static ssize_t smb_time_audit_pwrite(vfs_handle_struct *handle,
 760                                      files_struct *fsp,
 761                                      const void *data, size_t n,
 762                                      off_t offset)
 763 {
 764         ssize_t result;
 765         struct timespec ts1,ts2;
 766         double timediff;
 767
 768         clock_gettime_mono(&ts1);
 769         result = SMB_VFS_NEXT_PWRITE(handle, fsp, data, n, offset);
 770         clock_gettime_mono(&ts2);
 771         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 772
 773         if (timediff > audit_timeout) {
 774                 smb_time_audit_log_fsp("pwrite", timediff, fsp);
 775         }
 776
 777         return result;
 778 }
 779
 780 struct smb_time_audit_pwrite_state {
 781         struct files_struct *fsp;
 782         struct timespec ts1;
 783         ssize_t ret;
 784         int err;
 785 };
 786
 787 static void smb_time_audit_pwrite_done(struct tevent_req *subreq);
 788
 789 static struct tevent_req *smb_time_audit_pwrite_send(
 790         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 791         struct tevent_context *ev, struct files_struct *fsp,
 792         const void *data, size_t n, off_t offset)
 793 {
 794         struct tevent_req *req, *subreq;
 795         struct smb_time_audit_pwrite_state *state;
 796
 797         req = tevent_req_create(mem_ctx, &state,
 798                                 struct smb_time_audit_pwrite_state);
 799         if (req == NULL) {
 800                 return NULL;
 801         }
 802         clock_gettime_mono(&state->ts1);
 803         state->fsp = fsp;
 804
 805         subreq = SMB_VFS_NEXT_PWRITE_SEND(state, ev, handle, fsp, data,
 806                                          n, offset);
 807         if (tevent_req_nomem(subreq, req)) {
 808                 return tevent_req_post(req, ev);
 809         }
 810         tevent_req_set_callback(subreq, smb_time_audit_pwrite_done, req);
 811         return req;
 812 }
 813
 814 static void smb_time_audit_pwrite_done(struct tevent_req *subreq)
 815 {
 816         struct tevent_req *req = tevent_req_callback_data(
 817                 subreq, struct tevent_req);
 818         struct smb_time_audit_pwrite_state *state = tevent_req_data(
 819                 req, struct smb_time_audit_pwrite_state);
 820
 821         state->ret = SMB_VFS_PWRITE_RECV(subreq, &state->err);
 822         TALLOC_FREE(subreq);
 823         tevent_req_done(req);
 824 }
 825
 826 static ssize_t smb_time_audit_pwrite_recv(struct tevent_req *req, int *err)
 827 {
 828         struct smb_time_audit_pwrite_state *state = tevent_req_data(
 829                 req, struct smb_time_audit_pwrite_state);
 830         struct timespec ts2;
 831         double timediff;
 832
 833         clock_gettime_mono(&ts2);
 834         timediff = nsec_time_diff(&ts2,&state->ts1)*1.0e-9;
 835
 836         if (timediff > audit_timeout) {
 837                 smb_time_audit_log_fsp("pwrite", timediff, state->fsp);
 838         }
 839
 840         if (tevent_req_is_unix_error(req, err)) {
 841                 return -1;
 842         }
 843         *err = state->err;
 844         return state->ret;
 845 }
 846
 847 static off_t smb_time_audit_lseek(vfs_handle_struct *handle,
 848                                       files_struct *fsp,
 849                                       off_t offset, int whence)
 850 {
 851         off_t result;
 852         struct timespec ts1,ts2;
 853         double timediff;
 854
 855         clock_gettime_mono(&ts1);
 856         result = SMB_VFS_NEXT_LSEEK(handle, fsp, offset, whence);
 857         clock_gettime_mono(&ts2);
 858         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 859
 860         if (timediff > audit_timeout) {
 861                 smb_time_audit_log_fsp("lseek", timediff, fsp);
 862         }
 863
 864         return result;
 865 }
 866
 867 static ssize_t smb_time_audit_sendfile(vfs_handle_struct *handle, int tofd,
 868                                        files_struct *fromfsp,
 869                                        const DATA_BLOB *hdr, off_t offset,
 870                                        size_t n)
 871 {
 872         ssize_t result;
 873         struct timespec ts1,ts2;
 874         double timediff;
 875
 876         clock_gettime_mono(&ts1);
 877         result = SMB_VFS_NEXT_SENDFILE(handle, tofd, fromfsp, hdr, offset, n);
 878         clock_gettime_mono(&ts2);
 879         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 880
 881         if (timediff > audit_timeout) {
 882                 smb_time_audit_log_fsp("sendfile", timediff, fromfsp);
 883         }
 884
 885         return result;
 886 }
 887
 888 static ssize_t smb_time_audit_recvfile(vfs_handle_struct *handle, int fromfd,
 889                                        files_struct *tofsp,
 890                                        off_t offset,
 891                                        size_t n)
 892 {
 893         ssize_t result;
 894         struct timespec ts1,ts2;
 895         double timediff;
 896
 897         clock_gettime_mono(&ts1);
 898         result = SMB_VFS_NEXT_RECVFILE(handle, fromfd, tofsp, offset, n);
 899         clock_gettime_mono(&ts2);
 900         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 901
 902         if (timediff > audit_timeout) {
 903                 smb_time_audit_log_fsp("recvfile", timediff, tofsp);
 904         }
 905
 906         return result;
 907 }
 908
 909 static int smb_time_audit_rename(vfs_handle_struct *handle,
 910                                  const struct smb_filename *oldname,
 911                                  const struct smb_filename *newname)
 912 {
 913         int result;
 914         struct timespec ts1,ts2;
 915         double timediff;
 916
 917         clock_gettime_mono(&ts1);
 918         result = SMB_VFS_NEXT_RENAME(handle, oldname, newname);
 919         clock_gettime_mono(&ts2);
 920         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 921
 922         if (timediff > audit_timeout) {
 923                 smb_time_audit_log_smb_fname("rename", timediff, newname);
 924         }
 925
 926         return result;
 927 }
 928
 929 static int smb_time_audit_fsync(vfs_handle_struct *handle, files_struct *fsp)
 930 {
 931         int result;
 932         struct timespec ts1,ts2;
 933         double timediff;
 934
 935         clock_gettime_mono(&ts1);
 936         result = SMB_VFS_NEXT_FSYNC(handle, fsp);
 937         clock_gettime_mono(&ts2);
 938         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
 939
 940         if (timediff > audit_timeout) {
 941                 smb_time_audit_log_fsp("fsync", timediff, fsp);
 942         }
 943
 944         return result;
 945 }
 946
 947 struct smb_time_audit_fsync_state {
 948         struct files_struct *fsp;
 949         struct timespec ts1;
 950         int ret;
 951         int err;
 952 };
 953
 954 static void smb_time_audit_fsync_done(struct tevent_req *subreq);
 955
 956 static struct tevent_req *smb_time_audit_fsync_send(
 957         struct vfs_handle_struct *handle, TALLOC_CTX *mem_ctx,
 958         struct tevent_context *ev, struct files_struct *fsp)
 959 {
 960         struct tevent_req *req, *subreq;
 961         struct smb_time_audit_fsync_state *state;
 962
 963         req = tevent_req_create(mem_ctx, &state,
 964                                 struct smb_time_audit_fsync_state);
 965         if (req == NULL) {
 966                 return NULL;
 967         }
 968         clock_gettime_mono(&state->ts1);
 969         state->fsp = fsp;
 970
 971         subreq = SMB_VFS_NEXT_FSYNC_SEND(state, ev, handle, fsp);
 972         if (tevent_req_nomem(subreq, req)) {
 973                 return tevent_req_post(req, ev);
 974         }
 975         tevent_req_set_callback(subreq, smb_time_audit_fsync_done, req);
 976         return req;
 977 }
 978
 979 static void smb_time_audit_fsync_done(struct tevent_req *subreq)
 980 {
 981         struct tevent_req *req = tevent_req_callback_data(
 982                 subreq, struct tevent_req);
 983         struct smb_time_audit_fsync_state *state = tevent_req_data(
 984                 req, struct smb_time_audit_fsync_state);
 985
 986         state->ret = SMB_VFS_FSYNC_RECV(subreq, &state->err);
 987         TALLOC_FREE(subreq);
 988         tevent_req_done(req);
 989 }
 990
 991 static int smb_time_audit_fsync_recv(struct tevent_req *req, int *err)
 992 {
 993         struct smb_time_audit_fsync_state *state = tevent_req_data(
 994                 req, struct smb_time_audit_fsync_state);
 995         struct timespec ts2;
 996         double timediff;
 997
 998         clock_gettime_mono(&ts2);
 999         timediff = nsec_time_diff(&ts2,&state->ts1)*1.0e-9;
1000
1001         if (timediff > audit_timeout) {
1002                 smb_time_audit_log_fsp("fsync", timediff, state->fsp);
1003         }
1004
1005         if (tevent_req_is_unix_error(req, err)) {
1006                 return -1;
1007         }
1008         *err = state->err;
1009         return state->ret;
1010 }
1011
1012 static int smb_time_audit_stat(vfs_handle_struct *handle,
1013                                struct smb_filename *fname)
1014 {
1015         int result;
1016         struct timespec ts1,ts2;
1017         double timediff;
1018
1019         clock_gettime_mono(&ts1);
1020         result = SMB_VFS_NEXT_STAT(handle, fname);
1021         clock_gettime_mono(&ts2);
1022         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1023
1024         if (timediff > audit_timeout) {
1025                 smb_time_audit_log_smb_fname("stat", timediff, fname);
1026         }
1027
1028         return result;
1029 }
1030
1031 static int smb_time_audit_fstat(vfs_handle_struct *handle, files_struct *fsp,
1032                                 SMB_STRUCT_STAT *sbuf)
1033 {
1034         int result;
1035         struct timespec ts1,ts2;
1036         double timediff;
1037
1038         clock_gettime_mono(&ts1);
1039         result = SMB_VFS_NEXT_FSTAT(handle, fsp, sbuf);
1040         clock_gettime_mono(&ts2);
1041         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1042
1043         if (timediff > audit_timeout) {
1044                 smb_time_audit_log_fsp("fstat", timediff, fsp);
1045         }
1046
1047         return result;
1048 }
1049
1050 static int smb_time_audit_lstat(vfs_handle_struct *handle,
1051                                 struct smb_filename *path)
1052 {
1053         int result;
1054         struct timespec ts1,ts2;
1055         double timediff;
1056
1057         clock_gettime_mono(&ts1);
1058         result = SMB_VFS_NEXT_LSTAT(handle, path);
1059         clock_gettime_mono(&ts2);
1060         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1061
1062         if (timediff > audit_timeout) {
1063                 smb_time_audit_log_smb_fname("lstat", timediff, path);
1064         }
1065
1066         return result;
1067 }
1068
1069 static uint64_t smb_time_audit_get_alloc_size(vfs_handle_struct *handle,
1070                                               files_struct *fsp,
1071                                               const SMB_STRUCT_STAT *sbuf)
1072 {
1073         uint64_t result;
1074         struct timespec ts1,ts2;
1075         double timediff;
1076
1077         clock_gettime_mono(&ts1);
1078         result = SMB_VFS_NEXT_GET_ALLOC_SIZE(handle, fsp, sbuf);
1079         clock_gettime_mono(&ts2);
1080         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1081
1082         if (timediff > audit_timeout) {
1083                 smb_time_audit_log_fsp("get_alloc_size", timediff, fsp);
1084         }
1085
1086         return result;
1087 }
1088
1089 static int smb_time_audit_unlink(vfs_handle_struct *handle,
1090                                  const struct smb_filename *path)
1091 {
1092         int result;
1093         struct timespec ts1,ts2;
1094         double timediff;
1095
1096         clock_gettime_mono(&ts1);
1097         result = SMB_VFS_NEXT_UNLINK(handle, path);
1098         clock_gettime_mono(&ts2);
1099         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1100
1101         if (timediff > audit_timeout) {
1102                 smb_time_audit_log_smb_fname("unlink", timediff, path);
1103         }
1104
1105         return result;
1106 }
1107
1108 static int smb_time_audit_chmod(vfs_handle_struct *handle,
1109                                 const char *path, mode_t mode)
1110 {
1111         int result;
1112         struct timespec ts1,ts2;
1113         double timediff;
1114
1115         clock_gettime_mono(&ts1);
1116         result = SMB_VFS_NEXT_CHMOD(handle, path, mode);
1117         clock_gettime_mono(&ts2);
1118         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1119
1120         if (timediff > audit_timeout) {
1121                 smb_time_audit_log_fname("chmod", timediff, path);
1122         }
1123
1124         return result;
1125 }
1126
1127 static int smb_time_audit_fchmod(vfs_handle_struct *handle, files_struct *fsp,
1128                                  mode_t mode)
1129 {
1130         int result;
1131         struct timespec ts1,ts2;
1132         double timediff;
1133
1134         clock_gettime_mono(&ts1);
1135         result = SMB_VFS_NEXT_FCHMOD(handle, fsp, mode);
1136         clock_gettime_mono(&ts2);
1137         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1138
1139         if (timediff > audit_timeout) {
1140                 smb_time_audit_log_fsp("fchmod", timediff, fsp);
1141         }
1142
1143         return result;
1144 }
1145
1146 static int smb_time_audit_chown(vfs_handle_struct *handle,
1147                                 const char *path, uid_t uid, gid_t gid)
1148 {
1149         int result;
1150         struct timespec ts1,ts2;
1151         double timediff;
1152
1153         clock_gettime_mono(&ts1);
1154         result = SMB_VFS_NEXT_CHOWN(handle, path, uid, gid);
1155         clock_gettime_mono(&ts2);
1156         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1157
1158         if (timediff > audit_timeout) {
1159                 smb_time_audit_log_fname("chown", timediff, path);
1160         }
1161
1162         return result;
1163 }
1164
1165 static int smb_time_audit_fchown(vfs_handle_struct *handle, files_struct *fsp,
1166                                  uid_t uid, gid_t gid)
1167 {
1168         int result;
1169         struct timespec ts1,ts2;
1170         double timediff;
1171
1172         clock_gettime_mono(&ts1);
1173         result = SMB_VFS_NEXT_FCHOWN(handle, fsp, uid, gid);
1174         clock_gettime_mono(&ts2);
1175         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1176
1177         if (timediff > audit_timeout) {
1178                 smb_time_audit_log_fsp("fchown", timediff, fsp);
1179         }
1180
1181         return result;
1182 }
1183
1184 static int smb_time_audit_lchown(vfs_handle_struct *handle,
1185                                  const char *path, uid_t uid, gid_t gid)
1186 {
1187         int result;
1188         struct timespec ts1,ts2;
1189         double timediff;
1190
1191         clock_gettime_mono(&ts1);
1192         result = SMB_VFS_NEXT_LCHOWN(handle, path, uid, gid);
1193         clock_gettime_mono(&ts2);
1194         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1195
1196         if (timediff > audit_timeout) {
1197                 smb_time_audit_log_fname("lchown", timediff, path);
1198         }
1199
1200         return result;
1201 }
1202
1203 static int smb_time_audit_chdir(vfs_handle_struct *handle, const char *path)
1204 {
1205         int result;
1206         struct timespec ts1,ts2;
1207         double timediff;
1208
1209         clock_gettime_mono(&ts1);
1210         result = SMB_VFS_NEXT_CHDIR(handle, path);
1211         clock_gettime_mono(&ts2);
1212         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1213
1214         if (timediff > audit_timeout) {
1215                 smb_time_audit_log_fname("chdir", timediff, path);
1216         }
1217
1218         return result;
1219 }
1220
1221 static char *smb_time_audit_getwd(vfs_handle_struct *handle)
1222 {
1223         char *result;
1224         struct timespec ts1,ts2;
1225         double timediff;
1226
1227         clock_gettime_mono(&ts1);
1228         result = SMB_VFS_NEXT_GETWD(handle);
1229         clock_gettime_mono(&ts2);
1230         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1231
1232         if (timediff > audit_timeout) {
1233                 smb_time_audit_log("getwd", timediff);
1234         }
1235
1236         return result;
1237 }
1238
1239 static int smb_time_audit_ntimes(vfs_handle_struct *handle,
1240                                  const struct smb_filename *path,
1241                                  struct smb_file_time *ft)
1242 {
1243         int result;
1244         struct timespec ts1,ts2;
1245         double timediff;
1246
1247         clock_gettime_mono(&ts1);
1248         result = SMB_VFS_NEXT_NTIMES(handle, path, ft);
1249         clock_gettime_mono(&ts2);
1250         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1251
1252         if (timediff > audit_timeout) {
1253                 smb_time_audit_log_smb_fname("ntimes", timediff, path);
1254         }
1255
1256         return result;
1257 }
1258
1259 static int smb_time_audit_ftruncate(vfs_handle_struct *handle,
1260                                     files_struct *fsp,
1261                                     off_t len)
1262 {
1263         int result;
1264         struct timespec ts1,ts2;
1265         double timediff;
1266
1267         clock_gettime_mono(&ts1);
1268         result = SMB_VFS_NEXT_FTRUNCATE(handle, fsp, len);
1269         clock_gettime_mono(&ts2);
1270         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1271
1272         if (timediff > audit_timeout) {
1273                 smb_time_audit_log_fsp("ftruncate", timediff, fsp);
1274         }
1275
1276         return result;
1277 }
1278
1279 static int smb_time_audit_fallocate(vfs_handle_struct *handle,
1280                                     files_struct *fsp,
1281                                     uint32_t mode,
1282                                     off_t offset,
1283                                     off_t len)
1284 {
1285         int result;
1286         int saved_errno = 0;
1287         struct timespec ts1,ts2;
1288         double timediff;
1289
1290         clock_gettime_mono(&ts1);
1291         result = SMB_VFS_NEXT_FALLOCATE(handle, fsp, mode, offset, len);
1292         if (result == -1) {
1293                 saved_errno = errno;
1294         }
1295         clock_gettime_mono(&ts2);
1296         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1297
1298         if (timediff > audit_timeout) {
1299                 smb_time_audit_log_fsp("fallocate", timediff, fsp);
1300         }
1301         if (result == -1) {
1302                 errno = saved_errno;
1303         }
1304         return result;
1305 }
1306
1307 static bool smb_time_audit_lock(vfs_handle_struct *handle, files_struct *fsp,
1308                                 int op, off_t offset, off_t count,
1309                                 int type)
1310 {
1311         bool result;
1312         struct timespec ts1,ts2;
1313         double timediff;
1314
1315         clock_gettime_mono(&ts1);
1316         result = SMB_VFS_NEXT_LOCK(handle, fsp, op, offset, count, type);
1317         clock_gettime_mono(&ts2);
1318         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1319
1320         if (timediff > audit_timeout) {
1321                 smb_time_audit_log_fsp("lock", timediff, fsp);
1322         }
1323
1324         return result;
1325 }
1326
1327 static int smb_time_audit_kernel_flock(struct vfs_handle_struct *handle,
1328                                        struct files_struct *fsp,
1329                                        uint32 share_mode, uint32 access_mask)
1330 {
1331         int result;
1332         struct timespec ts1,ts2;
1333         double timediff;
1334
1335         clock_gettime_mono(&ts1);
1336         result = SMB_VFS_NEXT_KERNEL_FLOCK(handle, fsp, share_mode,
1337                                            access_mask);
1338         clock_gettime_mono(&ts2);
1339         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1340
1341         if (timediff > audit_timeout) {
1342                 smb_time_audit_log_fsp("kernel_flock", timediff, fsp);
1343         }
1344
1345         return result;
1346 }
1347
1348 static int smb_time_audit_linux_setlease(vfs_handle_struct *handle,
1349                                          files_struct *fsp,
1350                                          int leasetype)
1351 {
1352         int result;
1353         struct timespec ts1,ts2;
1354         double timediff;
1355
1356         clock_gettime_mono(&ts1);
1357         result = SMB_VFS_NEXT_LINUX_SETLEASE(handle, fsp, leasetype);
1358         clock_gettime_mono(&ts2);
1359         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1360
1361         if (timediff > audit_timeout) {
1362                 smb_time_audit_log_fsp("linux_setlease", timediff, fsp);
1363         }
1364
1365         return result;
1366 }
1367
1368 static bool smb_time_audit_getlock(vfs_handle_struct *handle,
1369                                    files_struct *fsp,
1370                                    off_t *poffset, off_t *pcount,
1371                                    int *ptype, pid_t *ppid)
1372 {
1373         bool result;
1374         struct timespec ts1,ts2;
1375         double timediff;
1376
1377         clock_gettime_mono(&ts1);
1378         result = SMB_VFS_NEXT_GETLOCK(handle, fsp, poffset, pcount, ptype,
1379                                       ppid);
1380         clock_gettime_mono(&ts2);
1381         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1382
1383         if (timediff > audit_timeout) {
1384                 smb_time_audit_log_fsp("getlock", timediff, fsp);
1385         }
1386
1387         return result;
1388 }
1389
1390 static int smb_time_audit_symlink(vfs_handle_struct *handle,
1391                                   const char *oldpath, const char *newpath)
1392 {
1393         int result;
1394         struct timespec ts1,ts2;
1395         double timediff;
1396
1397         clock_gettime_mono(&ts1);
1398         result = SMB_VFS_NEXT_SYMLINK(handle, oldpath, newpath);
1399         clock_gettime_mono(&ts2);
1400         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1401
1402         if (timediff > audit_timeout) {
1403                 smb_time_audit_log_fname("symlink", timediff, newpath);
1404         }
1405
1406         return result;
1407 }
1408
1409 static int smb_time_audit_readlink(vfs_handle_struct *handle,
1410                           const char *path, char *buf, size_t bufsiz)
1411 {
1412         int result;
1413         struct timespec ts1,ts2;
1414         double timediff;
1415
1416         clock_gettime_mono(&ts1);
1417         result = SMB_VFS_NEXT_READLINK(handle, path, buf, bufsiz);
1418         clock_gettime_mono(&ts2);
1419         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1420
1421         if (timediff > audit_timeout) {
1422                 smb_time_audit_log_fname("readlink", timediff, path);
1423         }
1424
1425         return result;
1426 }
1427
1428 static int smb_time_audit_link(vfs_handle_struct *handle,
1429                                const char *oldpath, const char *newpath)
1430 {
1431         int result;
1432         struct timespec ts1,ts2;
1433         double timediff;
1434
1435         clock_gettime_mono(&ts1);
1436         result = SMB_VFS_NEXT_LINK(handle, oldpath, newpath);
1437         clock_gettime_mono(&ts2);
1438         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1439
1440         if (timediff > audit_timeout) {
1441                 smb_time_audit_log_fname("link", timediff, newpath);
1442         }
1443
1444         return result;
1445 }
1446
1447 static int smb_time_audit_mknod(vfs_handle_struct *handle,
1448                                 const char *pathname, mode_t mode,
1449                                 SMB_DEV_T dev)
1450 {
1451         int result;
1452         struct timespec ts1,ts2;
1453         double timediff;
1454
1455         clock_gettime_mono(&ts1);
1456         result = SMB_VFS_NEXT_MKNOD(handle, pathname, mode, dev);
1457         clock_gettime_mono(&ts2);
1458         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1459
1460         if (timediff > audit_timeout) {
1461                 smb_time_audit_log_fname("mknod", timediff, pathname);
1462         }
1463
1464         return result;
1465 }
1466
1467 static char *smb_time_audit_realpath(vfs_handle_struct *handle,
1468                                      const char *path)
1469 {
1470         char *result;
1471         struct timespec ts1,ts2;
1472         double timediff;
1473
1474         clock_gettime_mono(&ts1);
1475         result = SMB_VFS_NEXT_REALPATH(handle, path);
1476         clock_gettime_mono(&ts2);
1477         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1478
1479         if (timediff > audit_timeout) {
1480                 smb_time_audit_log_fname("realpath", timediff, path);
1481         }
1482
1483         return result;
1484 }
1485
1486 static NTSTATUS smb_time_audit_notify_watch(struct vfs_handle_struct *handle,
1487                         struct sys_notify_context *ctx,
1488                         const char *path,
1489                         uint32_t *filter,
1490                         uint32_t *subdir_filter,
1491                         void (*callback)(struct sys_notify_context *ctx,
1492                                         void *private_data,
1493                                         struct notify_event *ev),
1494                         void *private_data, void *handle_p)
1495 {
1496         NTSTATUS result;
1497         struct timespec ts1,ts2;
1498         double timediff;
1499
1500         clock_gettime_mono(&ts1);
1501         result = SMB_VFS_NEXT_NOTIFY_WATCH(handle, ctx, path,
1502                                            filter, subdir_filter, callback,
1503                                            private_data, handle_p);
1504         clock_gettime_mono(&ts2);
1505         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1506
1507         if (timediff > audit_timeout) {
1508                 smb_time_audit_log_fname("notify_watch", timediff, path);
1509         }
1510
1511         return result;
1512 }
1513
1514 static int smb_time_audit_chflags(vfs_handle_struct *handle,
1515                                   const char *path, unsigned int flags)
1516 {
1517         int result;
1518         struct timespec ts1,ts2;
1519         double timediff;
1520
1521         clock_gettime_mono(&ts1);
1522         result = SMB_VFS_NEXT_CHFLAGS(handle, path, flags);
1523         clock_gettime_mono(&ts2);
1524         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1525
1526         if (timediff > audit_timeout) {
1527                 smb_time_audit_log_fname("chflags", timediff, path);
1528         }
1529
1530         return result;
1531 }
1532
1533 static struct file_id smb_time_audit_file_id_create(struct vfs_handle_struct *handle,
1534                                                     const SMB_STRUCT_STAT *sbuf)
1535 {
1536         struct file_id id_zero;
1537         struct file_id result;
1538         struct timespec ts1,ts2;
1539         double timediff;
1540
1541         ZERO_STRUCT(id_zero);
1542
1543         clock_gettime_mono(&ts1);
1544         result = SMB_VFS_NEXT_FILE_ID_CREATE(handle, sbuf);
1545         clock_gettime_mono(&ts2);
1546         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1547
1548         if (timediff > audit_timeout) {
1549                 smb_time_audit_log("file_id_create", timediff);
1550         }
1551
1552         return result;
1553 }
1554
1555 static NTSTATUS smb_time_audit_streaminfo(vfs_handle_struct *handle,
1556                                           struct files_struct *fsp,
1557                                           const char *fname,
1558                                           TALLOC_CTX *mem_ctx,
1559                                           unsigned int *pnum_streams,
1560                                           struct stream_struct **pstreams)
1561 {
1562         NTSTATUS result;
1563         struct timespec ts1,ts2;
1564         double timediff;
1565
1566         clock_gettime_mono(&ts1);
1567         result = SMB_VFS_NEXT_STREAMINFO(handle, fsp, fname, mem_ctx,
1568                                          pnum_streams, pstreams);
1569         clock_gettime_mono(&ts2);
1570         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1571
1572         if (timediff > audit_timeout) {
1573                 smb_time_audit_log_fsp("streaminfo", timediff, fsp);
1574         }
1575
1576         return result;
1577 }
1578
1579 static int smb_time_audit_get_real_filename(struct vfs_handle_struct *handle,
1580                                             const char *path,
1581                                             const char *name,
1582                                             TALLOC_CTX *mem_ctx,
1583                                             char **found_name)
1584 {
1585         int result;
1586         struct timespec ts1,ts2;
1587         double timediff;
1588
1589         clock_gettime_mono(&ts1);
1590         result = SMB_VFS_NEXT_GET_REAL_FILENAME(handle, path, name, mem_ctx,
1591                                                 found_name);
1592         clock_gettime_mono(&ts2);
1593         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1594
1595         if (timediff > audit_timeout) {
1596                 smb_time_audit_log_fname("get_real_filename", timediff, path);
1597         }
1598
1599         return result;
1600 }
1601
1602 static const char *smb_time_audit_connectpath(vfs_handle_struct *handle,
1603                                               const char *fname)
1604 {
1605         const char *result;
1606         struct timespec ts1,ts2;
1607         double timediff;
1608
1609         clock_gettime_mono(&ts1);
1610         result = SMB_VFS_NEXT_CONNECTPATH(handle, fname);
1611         clock_gettime_mono(&ts2);
1612         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1613
1614         if (timediff > audit_timeout) {
1615                 smb_time_audit_log_fname("connectpath", timediff, fname);
1616         }
1617
1618         return result;
1619 }
1620
1621 static NTSTATUS smb_time_audit_brl_lock_windows(struct vfs_handle_struct *handle,
1622                                                 struct byte_range_lock *br_lck,
1623                                                 struct lock_struct *plock,
1624                                                 bool blocking_lock)
1625 {
1626         NTSTATUS result;
1627         struct timespec ts1,ts2;
1628         double timediff;
1629
1630         clock_gettime_mono(&ts1);
1631         result = SMB_VFS_NEXT_BRL_LOCK_WINDOWS(handle, br_lck, plock,
1632                                                blocking_lock);
1633         clock_gettime_mono(&ts2);
1634         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1635
1636         if (timediff > audit_timeout) {
1637                 smb_time_audit_log_fsp("brl_lock_windows", timediff,
1638                                        brl_fsp(br_lck));
1639         }
1640
1641         return result;
1642 }
1643
1644 static bool smb_time_audit_brl_unlock_windows(struct vfs_handle_struct *handle,
1645                                               struct messaging_context *msg_ctx,
1646                                               struct byte_range_lock *br_lck,
1647                                               const struct lock_struct *plock)
1648 {
1649         bool result;
1650         struct timespec ts1,ts2;
1651         double timediff;
1652
1653         clock_gettime_mono(&ts1);
1654         result = SMB_VFS_NEXT_BRL_UNLOCK_WINDOWS(handle, msg_ctx, br_lck,
1655                                                  plock);
1656         clock_gettime_mono(&ts2);
1657         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1658
1659         if (timediff > audit_timeout) {
1660                 smb_time_audit_log_fsp("brl_unlock_windows", timediff,
1661                                        brl_fsp(br_lck));
1662         }
1663
1664         return result;
1665 }
1666
1667 static bool smb_time_audit_brl_cancel_windows(struct vfs_handle_struct *handle,
1668                                               struct byte_range_lock *br_lck,
1669                                               struct lock_struct *plock)
1670 {
1671         bool result;
1672         struct timespec ts1,ts2;
1673         double timediff;
1674
1675         clock_gettime_mono(&ts1);
1676         result = SMB_VFS_NEXT_BRL_CANCEL_WINDOWS(handle, br_lck, plock);
1677         clock_gettime_mono(&ts2);
1678         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1679
1680         if (timediff > audit_timeout) {
1681                 smb_time_audit_log_fsp("brl_cancel_windows", timediff,
1682                                        brl_fsp(br_lck));
1683         }
1684
1685         return result;
1686 }
1687
1688 static bool smb_time_audit_strict_lock(struct vfs_handle_struct *handle,
1689                                        struct files_struct *fsp,
1690                                        struct lock_struct *plock)
1691 {
1692         bool result;
1693         struct timespec ts1,ts2;
1694         double timediff;
1695
1696         clock_gettime_mono(&ts1);
1697         result = SMB_VFS_NEXT_STRICT_LOCK(handle, fsp, plock);
1698         clock_gettime_mono(&ts2);
1699         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1700
1701         if (timediff > audit_timeout) {
1702                 smb_time_audit_log_fsp("strict_lock", timediff, fsp);
1703         }
1704
1705         return result;
1706 }
1707
1708 static void smb_time_audit_strict_unlock(struct vfs_handle_struct *handle,
1709                                          struct files_struct *fsp,
1710                                          struct lock_struct *plock)
1711 {
1712         struct timespec ts1,ts2;
1713         double timediff;
1714
1715         clock_gettime_mono(&ts1);
1716         SMB_VFS_NEXT_STRICT_UNLOCK(handle, fsp, plock);
1717         clock_gettime_mono(&ts2);
1718         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1719
1720         if (timediff > audit_timeout) {
1721                 smb_time_audit_log_fsp("strict_unlock", timediff, fsp);
1722         }
1723 }
1724
1725 static NTSTATUS smb_time_audit_translate_name(struct vfs_handle_struct *handle,
1726                                               const char *name,
1727                                               enum vfs_translate_direction direction,
1728                                               TALLOC_CTX *mem_ctx,
1729                                               char **mapped_name)
1730 {
1731         NTSTATUS result;
1732         struct timespec ts1,ts2;
1733         double timediff;
1734
1735         clock_gettime_mono(&ts1);
1736         result = SMB_VFS_NEXT_TRANSLATE_NAME(handle, name, direction, mem_ctx,
1737                                              mapped_name);
1738         clock_gettime_mono(&ts2);
1739         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1740
1741         if (timediff > audit_timeout) {
1742                 smb_time_audit_log_fname("translate_name", timediff, name);
1743         }
1744
1745         return result;
1746 }
1747
1748 struct time_audit_cc_state {
1749         struct timespec ts_send;
1750         struct vfs_handle_struct *handle;
1751         off_t copied;
1752 };
1753 static void smb_time_audit_copy_chunk_done(struct tevent_req *subreq);
1754
1755 static struct tevent_req *smb_time_audit_copy_chunk_send(struct vfs_handle_struct *handle,
1756                                                          TALLOC_CTX *mem_ctx,
1757                                                          struct tevent_context *ev,
1758                                                          struct files_struct *src_fsp,
1759                                                          off_t src_off,
1760                                                          struct files_struct *dest_fsp,
1761                                                          off_t dest_off,
1762                                                          off_t num)
1763 {
1764         struct tevent_req *req;
1765         struct tevent_req *subreq;
1766         struct time_audit_cc_state *cc_state;
1767
1768         req = tevent_req_create(mem_ctx, &cc_state, struct time_audit_cc_state);
1769         if (req == NULL) {
1770                 return NULL;
1771         }
1772
1773         cc_state->handle = handle;
1774         clock_gettime_mono(&cc_state->ts_send);
1775         subreq = SMB_VFS_NEXT_COPY_CHUNK_SEND(handle, cc_state, ev,
1776                                               src_fsp, src_off,
1777                                               dest_fsp, dest_off, num);
1778         if (tevent_req_nomem(subreq, req)) {
1779                 return tevent_req_post(req, ev);
1780         }
1781
1782         tevent_req_set_callback(subreq, smb_time_audit_copy_chunk_done, req);
1783         return req;
1784 }
1785
1786 static void smb_time_audit_copy_chunk_done(struct tevent_req *subreq)
1787 {
1788         struct tevent_req *req = tevent_req_callback_data(
1789                 subreq, struct tevent_req);
1790         struct time_audit_cc_state *cc_state
1791                         = tevent_req_data(req, struct time_audit_cc_state);
1792         NTSTATUS status;
1793
1794         status = SMB_VFS_NEXT_COPY_CHUNK_RECV(cc_state->handle,
1795                                               subreq,
1796                                               &cc_state->copied);
1797         TALLOC_FREE(subreq);
1798         if (tevent_req_nterror(req, status)) {
1799                 return;
1800         }
1801         tevent_req_done(req);
1802 }
1803
1804 static NTSTATUS smb_time_audit_copy_chunk_recv(struct vfs_handle_struct *handle,
1805                                                struct tevent_req *req,
1806                                                off_t *copied)
1807 {
1808         struct time_audit_cc_state *cc_state
1809                         = tevent_req_data(req, struct time_audit_cc_state);
1810         struct timespec ts_recv;
1811         double timediff;
1812         NTSTATUS status;
1813
1814         clock_gettime_mono(&ts_recv);
1815         timediff = nsec_time_diff(&ts_recv, &cc_state->ts_send)*1.0e-9;
1816         if (timediff > audit_timeout) {
1817                 smb_time_audit_log("copy_chunk", timediff);
1818         }
1819
1820         *copied = cc_state->copied;
1821         if (tevent_req_is_nterror(req, &status)) {
1822                 tevent_req_received(req);
1823                 return status;
1824         }
1825
1826         tevent_req_received(req);
1827         return NT_STATUS_OK;
1828 }
1829
1830 static NTSTATUS smb_time_audit_get_compression(vfs_handle_struct *handle,
1831                                                TALLOC_CTX *mem_ctx,
1832                                                struct files_struct *fsp,
1833                                                struct smb_filename *smb_fname,
1834                                                uint16_t *_compression_fmt)
1835 {
1836         NTSTATUS result;
1837         struct timespec ts1,ts2;
1838         double timediff;
1839
1840         clock_gettime_mono(&ts1);
1841         result = SMB_VFS_NEXT_GET_COMPRESSION(handle, mem_ctx, fsp, smb_fname,
1842                                               _compression_fmt);
1843         clock_gettime_mono(&ts2);
1844         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1845
1846         if (timediff > audit_timeout) {
1847                 if (fsp !=  NULL) {
1848                         smb_time_audit_log_fsp("get_compression",
1849                                                timediff, fsp);
1850                 } else {
1851                         smb_time_audit_log_smb_fname("get_compression",
1852                                                      timediff, smb_fname);
1853                 }
1854         }
1855
1856         return result;
1857 }
1858
1859 static NTSTATUS smb_time_audit_set_compression(vfs_handle_struct *handle,
1860                                                TALLOC_CTX *mem_ctx,
1861                                                struct files_struct *fsp,
1862                                                uint16_t compression_fmt)
1863 {
1864         NTSTATUS result;
1865         struct timespec ts1,ts2;
1866         double timediff;
1867
1868         clock_gettime_mono(&ts1);
1869         result = SMB_VFS_NEXT_SET_COMPRESSION(handle, mem_ctx, fsp,
1870                                               compression_fmt);
1871         clock_gettime_mono(&ts2);
1872         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1873
1874         if (timediff > audit_timeout) {
1875                 smb_time_audit_log_fsp("set_compression", timediff, fsp);
1876         }
1877
1878         return result;
1879 }
1880
1881 static NTSTATUS smb_time_audit_readdir_attr(struct vfs_handle_struct *handle,
1882                                             const struct smb_filename *fname,
1883                                             TALLOC_CTX *mem_ctx,
1884                                             struct readdir_attr_data **pattr_data)
1885 {
1886         NTSTATUS status;
1887         struct timespec ts1,ts2;
1888         double timediff;
1889
1890         clock_gettime_mono(&ts1);
1891         status = SMB_VFS_NEXT_READDIR_ATTR(handle, fname, mem_ctx, pattr_data);
1892         clock_gettime_mono(&ts2);
1893         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1894
1895         if (timediff > audit_timeout) {
1896                 smb_time_audit_log_smb_fname("readdir_attr", timediff, fname);
1897         }
1898
1899         return status;
1900 }
1901
1902 static NTSTATUS smb_time_audit_fget_nt_acl(vfs_handle_struct *handle,
1903                                            files_struct *fsp,
1904                                            uint32 security_info,
1905                                            TALLOC_CTX *mem_ctx,
1906                                            struct security_descriptor **ppdesc)
1907 {
1908         NTSTATUS result;
1909         struct timespec ts1,ts2;
1910         double timediff;
1911
1912         clock_gettime_mono(&ts1);
1913         result = SMB_VFS_NEXT_FGET_NT_ACL(handle, fsp, security_info,
1914                                           mem_ctx, ppdesc);
1915         clock_gettime_mono(&ts2);
1916         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1917
1918         if (timediff > audit_timeout) {
1919                 smb_time_audit_log_fsp("fget_nt_acl", timediff, fsp);
1920         }
1921
1922         return result;
1923 }
1924
1925 static NTSTATUS smb_time_audit_get_nt_acl(vfs_handle_struct *handle,
1926                                           const char *name,
1927                                           uint32 security_info,
1928                                           TALLOC_CTX *mem_ctx,
1929                                           struct security_descriptor **ppdesc)
1930 {
1931         NTSTATUS result;
1932         struct timespec ts1,ts2;
1933         double timediff;
1934
1935         clock_gettime_mono(&ts1);
1936         result = SMB_VFS_NEXT_GET_NT_ACL(handle, name, security_info,
1937                                          mem_ctx, ppdesc);
1938         clock_gettime_mono(&ts2);
1939         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1940
1941         if (timediff > audit_timeout) {
1942                 smb_time_audit_log_fname("get_nt_acl", timediff, name);
1943         }
1944
1945         return result;
1946 }
1947
1948 static NTSTATUS smb_time_audit_fset_nt_acl(vfs_handle_struct *handle,
1949                                            files_struct *fsp,
1950                                            uint32 security_info_sent,
1951                                            const struct security_descriptor *psd)
1952 {
1953         NTSTATUS result;
1954         struct timespec ts1,ts2;
1955         double timediff;
1956
1957         clock_gettime_mono(&ts1);
1958         result = SMB_VFS_NEXT_FSET_NT_ACL(handle, fsp, security_info_sent,
1959                                           psd);
1960         clock_gettime_mono(&ts2);
1961         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1962
1963         if (timediff > audit_timeout) {
1964                 smb_time_audit_log_fsp("fset_nt_acl", timediff, fsp);
1965         }
1966
1967         return result;
1968 }
1969
1970 static int smb_time_audit_chmod_acl(vfs_handle_struct *handle,
1971                                     const char *path, mode_t mode)
1972 {
1973         int result;
1974         struct timespec ts1,ts2;
1975         double timediff;
1976
1977         clock_gettime_mono(&ts1);
1978         result = SMB_VFS_NEXT_CHMOD_ACL(handle, path, mode);
1979         clock_gettime_mono(&ts2);
1980         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
1981
1982         if (timediff > audit_timeout) {
1983                 smb_time_audit_log_fname("chmod_acl", timediff, path);
1984         }
1985
1986         return result;
1987 }
1988
1989 static int smb_time_audit_fchmod_acl(vfs_handle_struct *handle,
1990                                      files_struct *fsp, mode_t mode)
1991 {
1992         int result;
1993         struct timespec ts1,ts2;
1994         double timediff;
1995
1996         clock_gettime_mono(&ts1);
1997         result = SMB_VFS_NEXT_FCHMOD_ACL(handle, fsp, mode);
1998         clock_gettime_mono(&ts2);
1999         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2000
2001         if (timediff > audit_timeout) {
2002                 smb_time_audit_log_fsp("fchmod_acl", timediff, fsp);
2003         }
2004
2005         return result;
2006 }
2007
2008 static SMB_ACL_T smb_time_audit_sys_acl_get_file(vfs_handle_struct *handle,
2009                                                  const char *path_p,
2010                                                  SMB_ACL_TYPE_T type,
2011                                                  TALLOC_CTX *mem_ctx)
2012 {
2013         SMB_ACL_T result;
2014         struct timespec ts1,ts2;
2015         double timediff;
2016
2017         clock_gettime_mono(&ts1);
2018         result = SMB_VFS_NEXT_SYS_ACL_GET_FILE(handle, path_p, type, mem_ctx);
2019         clock_gettime_mono(&ts2);
2020         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2021
2022         if (timediff > audit_timeout) {
2023                 smb_time_audit_log_fname("sys_acl_get_file", timediff, path_p);
2024         }
2025
2026         return result;
2027 }
2028
2029 static SMB_ACL_T smb_time_audit_sys_acl_get_fd(vfs_handle_struct *handle,
2030                                                files_struct *fsp,
2031                                                TALLOC_CTX *mem_ctx)
2032 {
2033         SMB_ACL_T result;
2034         struct timespec ts1,ts2;
2035         double timediff;
2036
2037         clock_gettime_mono(&ts1);
2038         result = SMB_VFS_NEXT_SYS_ACL_GET_FD(handle, fsp, mem_ctx);
2039         clock_gettime_mono(&ts2);
2040         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2041
2042         if (timediff > audit_timeout) {
2043                 smb_time_audit_log_fsp("sys_acl_get_fd", timediff, fsp);
2044         }
2045
2046         return result;
2047 }
2048
2049
2050 static int smb_time_audit_sys_acl_blob_get_file(vfs_handle_struct *handle,
2051                                                 const char *path_p,
2052                                                 TALLOC_CTX *mem_ctx,
2053                                                 char **blob_description,
2054                                                 DATA_BLOB *blob)
2055 {
2056         int result;
2057         struct timespec ts1,ts2;
2058         double timediff;
2059
2060         clock_gettime_mono(&ts1);
2061         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FILE(handle, path_p, mem_ctx, blob_description, blob);
2062         clock_gettime_mono(&ts2);
2063         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2064
2065         if (timediff > audit_timeout) {
2066                 smb_time_audit_log("sys_acl_blob_get_file", timediff);
2067         }
2068
2069         return result;
2070 }
2071
2072 static int smb_time_audit_sys_acl_blob_get_fd(vfs_handle_struct *handle,
2073                                               files_struct *fsp,
2074                                               TALLOC_CTX *mem_ctx,
2075                                               char **blob_description,
2076                                               DATA_BLOB *blob)
2077 {
2078         int result;
2079         struct timespec ts1,ts2;
2080         double timediff;
2081
2082         clock_gettime_mono(&ts1);
2083         result = SMB_VFS_NEXT_SYS_ACL_BLOB_GET_FD(handle, fsp, mem_ctx, blob_description, blob);
2084         clock_gettime_mono(&ts2);
2085         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2086
2087         if (timediff > audit_timeout) {
2088                 smb_time_audit_log("sys_acl_blob_get_fd", timediff);
2089         }
2090
2091         return result;
2092 }
2093
2094 static int smb_time_audit_sys_acl_set_file(vfs_handle_struct *handle,
2095                                            const char *name,
2096                                            SMB_ACL_TYPE_T acltype,
2097                                            SMB_ACL_T theacl)
2098 {
2099         int result;
2100         struct timespec ts1,ts2;
2101         double timediff;
2102
2103         clock_gettime_mono(&ts1);
2104         result = SMB_VFS_NEXT_SYS_ACL_SET_FILE(handle, name, acltype,
2105                                                theacl);
2106         clock_gettime_mono(&ts2);
2107         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2108
2109         if (timediff > audit_timeout) {
2110                 smb_time_audit_log_fname("sys_acl_set_file", timediff, name);
2111         }
2112
2113         return result;
2114 }
2115
2116 static int smb_time_audit_sys_acl_set_fd(vfs_handle_struct *handle,
2117                                          files_struct *fsp,
2118                                          SMB_ACL_T theacl)
2119 {
2120         int result;
2121         struct timespec ts1,ts2;
2122         double timediff;
2123
2124         clock_gettime_mono(&ts1);
2125         result = SMB_VFS_NEXT_SYS_ACL_SET_FD(handle, fsp, theacl);
2126         clock_gettime_mono(&ts2);
2127         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2128
2129         if (timediff > audit_timeout) {
2130                 smb_time_audit_log_fsp("sys_acl_set_fd", timediff, fsp);
2131         }
2132
2133         return result;
2134 }
2135
2136 static int smb_time_audit_sys_acl_delete_def_file(vfs_handle_struct *handle,
2137                                                   const char *path)
2138 {
2139         int result;
2140         struct timespec ts1,ts2;
2141         double timediff;
2142
2143         clock_gettime_mono(&ts1);
2144         result = SMB_VFS_NEXT_SYS_ACL_DELETE_DEF_FILE(handle, path);
2145         clock_gettime_mono(&ts2);
2146         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2147
2148         if (timediff > audit_timeout) {
2149                 smb_time_audit_log_fname("sys_acl_delete_def_file", timediff, path);
2150         }
2151
2152         return result;
2153 }
2154
2155 static ssize_t smb_time_audit_getxattr(struct vfs_handle_struct *handle,
2156                                        const char *path, const char *name,
2157                                        void *value, size_t size)
2158 {
2159         ssize_t result;
2160         struct timespec ts1,ts2;
2161         double timediff;
2162
2163         clock_gettime_mono(&ts1);
2164         result = SMB_VFS_NEXT_GETXATTR(handle, path, name, value, size);
2165         clock_gettime_mono(&ts2);
2166         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2167
2168         if (timediff > audit_timeout) {
2169                 smb_time_audit_log_fname("getxattr", timediff, path);
2170         }
2171
2172         return result;
2173 }
2174
2175 static ssize_t smb_time_audit_fgetxattr(struct vfs_handle_struct *handle,
2176                                         struct files_struct *fsp,
2177                                         const char *name, void *value,
2178                                         size_t size)
2179 {
2180         ssize_t result;
2181         struct timespec ts1,ts2;
2182         double timediff;
2183
2184         clock_gettime_mono(&ts1);
2185         result = SMB_VFS_NEXT_FGETXATTR(handle, fsp, name, value, size);
2186         clock_gettime_mono(&ts2);
2187         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2188
2189         if (timediff > audit_timeout) {
2190                 smb_time_audit_log_fsp("fgetxattr", timediff, fsp);
2191         }
2192
2193         return result;
2194 }
2195
2196 static ssize_t smb_time_audit_listxattr(struct vfs_handle_struct *handle,
2197                                         const char *path, char *list,
2198                                         size_t size)
2199 {
2200         ssize_t result;
2201         struct timespec ts1,ts2;
2202         double timediff;
2203
2204         clock_gettime_mono(&ts1);
2205         result = SMB_VFS_NEXT_LISTXATTR(handle, path, list, size);
2206         clock_gettime_mono(&ts2);
2207         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2208
2209         if (timediff > audit_timeout) {
2210                 smb_time_audit_log_fname("listxattr", timediff, path);
2211         }
2212
2213         return result;
2214 }
2215
2216 static ssize_t smb_time_audit_flistxattr(struct vfs_handle_struct *handle,
2217                                          struct files_struct *fsp, char *list,
2218                                          size_t size)
2219 {
2220         ssize_t result;
2221         struct timespec ts1,ts2;
2222         double timediff;
2223
2224         clock_gettime_mono(&ts1);
2225         result = SMB_VFS_NEXT_FLISTXATTR(handle, fsp, list, size);
2226         clock_gettime_mono(&ts2);
2227         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2228
2229         if (timediff > audit_timeout) {
2230                 smb_time_audit_log_fsp("flistxattr", timediff, fsp);
2231         }
2232
2233         return result;
2234 }
2235
2236 static int smb_time_audit_removexattr(struct vfs_handle_struct *handle,
2237                                       const char *path, const char *name)
2238 {
2239         int result;
2240         struct timespec ts1,ts2;
2241         double timediff;
2242
2243         clock_gettime_mono(&ts1);
2244         result = SMB_VFS_NEXT_REMOVEXATTR(handle, path, name);
2245         clock_gettime_mono(&ts2);
2246         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2247
2248         if (timediff > audit_timeout) {
2249                 smb_time_audit_log_fname("removexattr", timediff, path);
2250         }
2251
2252         return result;
2253 }
2254
2255 static int smb_time_audit_fremovexattr(struct vfs_handle_struct *handle,
2256                                        struct files_struct *fsp,
2257                                        const char *name)
2258 {
2259         int result;
2260         struct timespec ts1,ts2;
2261         double timediff;
2262
2263         clock_gettime_mono(&ts1);
2264         result = SMB_VFS_NEXT_FREMOVEXATTR(handle, fsp, name);
2265         clock_gettime_mono(&ts2);
2266         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2267
2268         if (timediff > audit_timeout) {
2269                 smb_time_audit_log_fsp("fremovexattr", timediff, fsp);
2270         }
2271
2272         return result;
2273 }
2274
2275 static int smb_time_audit_setxattr(struct vfs_handle_struct *handle,
2276                                    const char *path, const char *name,
2277                                    const void *value, size_t size,
2278                                    int flags)
2279 {
2280         int result;
2281         struct timespec ts1,ts2;
2282         double timediff;
2283
2284         clock_gettime_mono(&ts1);
2285         result = SMB_VFS_NEXT_SETXATTR(handle, path, name, value, size,
2286                                        flags);
2287         clock_gettime_mono(&ts2);
2288         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2289
2290         if (timediff > audit_timeout) {
2291                 smb_time_audit_log_fname("setxattr", timediff, path);
2292         }
2293
2294         return result;
2295 }
2296
2297 static int smb_time_audit_fsetxattr(struct vfs_handle_struct *handle,
2298                                     struct files_struct *fsp, const char *name,
2299                                     const void *value, size_t size, int flags)
2300 {
2301         int result;
2302         struct timespec ts1,ts2;
2303         double timediff;
2304
2305         clock_gettime_mono(&ts1);
2306         result = SMB_VFS_NEXT_FSETXATTR(handle, fsp, name, value, size, flags);
2307         clock_gettime_mono(&ts2);
2308         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2309
2310         if (timediff > audit_timeout) {
2311                 smb_time_audit_log_fsp("fsetxattr", timediff, fsp);
2312         }
2313
2314         return result;
2315 }
2316
2317 static bool smb_time_audit_aio_force(struct vfs_handle_struct *handle,
2318                                      struct files_struct *fsp)
2319 {
2320         bool result;
2321         struct timespec ts1,ts2;
2322         double timediff;
2323
2324         clock_gettime_mono(&ts1);
2325         result = SMB_VFS_NEXT_AIO_FORCE(handle, fsp);
2326         clock_gettime_mono(&ts2);
2327         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2328
2329         if (timediff > audit_timeout) {
2330                 smb_time_audit_log_fsp("aio_force", timediff, fsp);
2331         }
2332
2333         return result;
2334 }
2335
2336 static bool smb_time_audit_is_offline(struct vfs_handle_struct *handle,
2337                                       const struct smb_filename *fname,
2338                                       SMB_STRUCT_STAT *sbuf)
2339 {
2340         bool result;
2341         struct timespec ts1,ts2;
2342         double timediff;
2343
2344         clock_gettime_mono(&ts1);
2345         result = SMB_VFS_NEXT_IS_OFFLINE(handle, fname, sbuf);
2346         clock_gettime_mono(&ts2);
2347         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2348
2349         if (timediff > audit_timeout) {
2350                 smb_time_audit_log_smb_fname("is_offline", timediff, fname);
2351         }
2352
2353         return result;
2354 }
2355
2356 static int smb_time_audit_set_offline(struct vfs_handle_struct *handle,
2357                                       const struct smb_filename *fname)
2358 {
2359         int result;
2360         struct timespec ts1,ts2;
2361         double timediff;
2362
2363         clock_gettime_mono(&ts1);
2364         result = SMB_VFS_NEXT_SET_OFFLINE(handle, fname);
2365         clock_gettime_mono(&ts2);
2366         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2367
2368         if (timediff > audit_timeout) {
2369                 smb_time_audit_log_smb_fname("set_offline", timediff, fname);
2370         }
2371
2372         return result;
2373 }
2374
2375 static NTSTATUS smb_time_audit_durable_cookie(struct vfs_handle_struct *handle,
2376                                               struct files_struct *fsp,
2377                                               TALLOC_CTX *mem_ctx,
2378                                               DATA_BLOB *cookie)
2379 {
2380         NTSTATUS result;
2381         struct timespec ts1,ts2;
2382         double timediff;
2383
2384         clock_gettime_mono(&ts1);
2385         result = SMB_VFS_NEXT_DURABLE_COOKIE(handle, fsp, mem_ctx, cookie);
2386         clock_gettime_mono(&ts2);
2387         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2388
2389         if (timediff > audit_timeout) {
2390                 smb_time_audit_log_fsp("durable_cookie", timediff, fsp);
2391         }
2392
2393         return result;
2394 }
2395
2396 static NTSTATUS smb_time_audit_durable_disconnect(struct vfs_handle_struct *handle,
2397                                                   struct files_struct *fsp,
2398                                                   const DATA_BLOB old_cookie,
2399                                                   TALLOC_CTX *mem_ctx,
2400                                                   DATA_BLOB *new_cookie)
2401 {
2402         NTSTATUS result;
2403         struct timespec ts1,ts2;
2404         double timediff;
2405
2406         clock_gettime_mono(&ts1);
2407         result = SMB_VFS_NEXT_DURABLE_DISCONNECT(handle, fsp, old_cookie,
2408                                                  mem_ctx, new_cookie);
2409         clock_gettime_mono(&ts2);
2410         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2411
2412         if (timediff > audit_timeout) {
2413                 smb_time_audit_log_fsp("durable_disconnect", timediff, fsp);
2414         }
2415
2416         return result;
2417 }
2418
2419 static NTSTATUS smb_time_audit_durable_reconnect(struct vfs_handle_struct *handle,
2420                                                  struct smb_request *smb1req,
2421                                                  struct smbXsrv_open *op,
2422                                                  const DATA_BLOB old_cookie,
2423                                                  TALLOC_CTX *mem_ctx,
2424                                                  struct files_struct **fsp,
2425                                                  DATA_BLOB *new_cookie)
2426 {
2427         NTSTATUS result;
2428         struct timespec ts1,ts2;
2429         double timediff;
2430
2431         clock_gettime_mono(&ts1);
2432         result = SMB_VFS_NEXT_DURABLE_RECONNECT(handle, smb1req, op, old_cookie,
2433                                                 mem_ctx, fsp, new_cookie);
2434         clock_gettime_mono(&ts2);
2435         timediff = nsec_time_diff(&ts2,&ts1)*1.0e-9;
2436
2437         if (timediff > audit_timeout) {
2438                 smb_time_audit_log("durable_reconnect", timediff);
2439         }
2440
2441         return result;
2442 }
2443
2444 /* VFS operations */
2445
2446 static struct vfs_fn_pointers vfs_time_audit_fns = {
2447         .connect_fn = smb_time_audit_connect,
2448         .disconnect_fn = smb_time_audit_disconnect,
2449         .disk_free_fn = smb_time_audit_disk_free,
2450         .get_quota_fn = smb_time_audit_get_quota,
2451         .set_quota_fn = smb_time_audit_set_quota,
2452         .get_shadow_copy_data_fn = smb_time_audit_get_shadow_copy_data,
2453         .statvfs_fn = smb_time_audit_statvfs,
2454         .fs_capabilities_fn = smb_time_audit_fs_capabilities,
2455         .snap_check_path_fn = smb_time_audit_snap_check_path,
2456         .snap_create_fn = smb_time_audit_snap_create,
2457         .snap_delete_fn = smb_time_audit_snap_delete,
2458         .opendir_fn = smb_time_audit_opendir,
2459         .fdopendir_fn = smb_time_audit_fdopendir,
2460         .readdir_fn = smb_time_audit_readdir,
2461         .seekdir_fn = smb_time_audit_seekdir,
2462         .telldir_fn = smb_time_audit_telldir,
2463         .rewind_dir_fn = smb_time_audit_rewinddir,
2464         .mkdir_fn = smb_time_audit_mkdir,
2465         .rmdir_fn = smb_time_audit_rmdir,
2466         .closedir_fn = smb_time_audit_closedir,
2467         .init_search_op_fn = smb_time_audit_init_search_op,
2468         .open_fn = smb_time_audit_open,
2469         .create_file_fn = smb_time_audit_create_file,
2470         .close_fn = smb_time_audit_close,
2471         .read_fn = smb_time_audit_read,
2472         .pread_fn = smb_time_audit_pread,
2473         .pread_send_fn = smb_time_audit_pread_send,
2474         .pread_recv_fn = smb_time_audit_pread_recv,
2475         .write_fn = smb_time_audit_write,
2476         .pwrite_fn = smb_time_audit_pwrite,
2477         .pwrite_send_fn = smb_time_audit_pwrite_send,
2478         .pwrite_recv_fn = smb_time_audit_pwrite_recv,
2479         .lseek_fn = smb_time_audit_lseek,
2480         .sendfile_fn = smb_time_audit_sendfile,
2481         .recvfile_fn = smb_time_audit_recvfile,
2482         .rename_fn = smb_time_audit_rename,
2483         .fsync_fn = smb_time_audit_fsync,
2484         .fsync_send_fn = smb_time_audit_fsync_send,
2485         .fsync_recv_fn = smb_time_audit_fsync_recv,
2486         .stat_fn = smb_time_audit_stat,
2487         .fstat_fn = smb_time_audit_fstat,
2488         .lstat_fn = smb_time_audit_lstat,
2489         .get_alloc_size_fn = smb_time_audit_get_alloc_size,
2490         .unlink_fn = smb_time_audit_unlink,
2491         .chmod_fn = smb_time_audit_chmod,
2492         .fchmod_fn = smb_time_audit_fchmod,
2493         .chown_fn = smb_time_audit_chown,
2494         .fchown_fn = smb_time_audit_fchown,
2495         .lchown_fn = smb_time_audit_lchown,
2496         .chdir_fn = smb_time_audit_chdir,
2497         .getwd_fn = smb_time_audit_getwd,
2498         .ntimes_fn = smb_time_audit_ntimes,
2499         .ftruncate_fn = smb_time_audit_ftruncate,
2500         .fallocate_fn = smb_time_audit_fallocate,
2501         .lock_fn = smb_time_audit_lock,
2502         .kernel_flock_fn = smb_time_audit_kernel_flock,
2503         .linux_setlease_fn = smb_time_audit_linux_setlease,
2504         .getlock_fn = smb_time_audit_getlock,
2505         .symlink_fn = smb_time_audit_symlink,
2506         .readlink_fn = smb_time_audit_readlink,
2507         .link_fn = smb_time_audit_link,
2508         .mknod_fn = smb_time_audit_mknod,
2509         .realpath_fn = smb_time_audit_realpath,
2510         .notify_watch_fn = smb_time_audit_notify_watch,
2511         .chflags_fn = smb_time_audit_chflags,
2512         .file_id_create_fn = smb_time_audit_file_id_create,
2513         .streaminfo_fn = smb_time_audit_streaminfo,
2514         .get_real_filename_fn = smb_time_audit_get_real_filename,
2515         .connectpath_fn = smb_time_audit_connectpath,
2516         .brl_lock_windows_fn = smb_time_audit_brl_lock_windows,
2517         .brl_unlock_windows_fn = smb_time_audit_brl_unlock_windows,
2518         .brl_cancel_windows_fn = smb_time_audit_brl_cancel_windows,
2519         .strict_lock_fn = smb_time_audit_strict_lock,
2520         .strict_unlock_fn = smb_time_audit_strict_unlock,
2521         .translate_name_fn = smb_time_audit_translate_name,
2522         .copy_chunk_send_fn = smb_time_audit_copy_chunk_send,
2523         .copy_chunk_recv_fn = smb_time_audit_copy_chunk_recv,
2524         .get_compression_fn = smb_time_audit_get_compression,
2525         .set_compression_fn = smb_time_audit_set_compression,
2526         .readdir_attr_fn = smb_time_audit_readdir_attr,
2527         .fget_nt_acl_fn = smb_time_audit_fget_nt_acl,
2528         .get_nt_acl_fn = smb_time_audit_get_nt_acl,
2529         .fset_nt_acl_fn = smb_time_audit_fset_nt_acl,
2530         .chmod_acl_fn = smb_time_audit_chmod_acl,
2531         .fchmod_acl_fn = smb_time_audit_fchmod_acl,
2532         .sys_acl_get_file_fn = smb_time_audit_sys_acl_get_file,
2533         .sys_acl_get_fd_fn = smb_time_audit_sys_acl_get_fd,
2534         .sys_acl_blob_get_file_fn = smb_time_audit_sys_acl_blob_get_file,
2535         .sys_acl_blob_get_fd_fn = smb_time_audit_sys_acl_blob_get_fd,
2536         .sys_acl_set_file_fn = smb_time_audit_sys_acl_set_file,
2537         .sys_acl_set_fd_fn = smb_time_audit_sys_acl_set_fd,
2538         .sys_acl_delete_def_file_fn = smb_time_audit_sys_acl_delete_def_file,
2539         .getxattr_fn = smb_time_audit_getxattr,
2540         .fgetxattr_fn = smb_time_audit_fgetxattr,
2541         .listxattr_fn = smb_time_audit_listxattr,
2542         .flistxattr_fn = smb_time_audit_flistxattr,
2543         .removexattr_fn = smb_time_audit_removexattr,
2544         .fremovexattr_fn = smb_time_audit_fremovexattr,
2545         .setxattr_fn = smb_time_audit_setxattr,
2546         .fsetxattr_fn = smb_time_audit_fsetxattr,
2547         .aio_force_fn = smb_time_audit_aio_force,
2548         .is_offline_fn = smb_time_audit_is_offline,
2549         .set_offline_fn = smb_time_audit_set_offline,
2550         .durable_cookie_fn = smb_time_audit_durable_cookie,
2551         .durable_disconnect_fn = smb_time_audit_durable_disconnect,
2552         .durable_reconnect_fn = smb_time_audit_durable_reconnect,
2553 };
2554
2555
2556 NTSTATUS vfs_time_audit_init(void);
2557 NTSTATUS vfs_time_audit_init(void)
2558 {
2559         audit_timeout = (double)lp_parm_int(-1, "time_audit", "timeout",
2560                                             10000) / 1000.0;
2561         return smb_register_vfs(SMB_VFS_INTERFACE_VERSION, "time_audit",
2562                                 &vfs_time_audit_fns);
2563 }